CVE-2026-107761

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platfor...

keyhacks

KeyHacks muestra métodos para validar diferentes claves de API encontradas en un programa Bug Bounty o una prueba de penetración. @Gwen001 ha automatizado todo el proceso disponible aquí y se puede encontrar aquí Tabla de Contenidos Clave de API de ABTasty Clave de API de Algolia Claves de API de...

CVE-2026-107761 Channel tokens and organization API key exposed in API responses

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platfor...

CVE-2026-107761 Channel tokens and organization API key exposed in API responses

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platfor...

EUVD-2026-97100

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platfor...

cariddi

Toma una lista de dominios, rastrea urls y escanea en busca de endpoints, secretos, claves api, extensiones de archivo, tokens y más Coded with 💙 by edoardottt Share on Twitter! Install • Usage • Get Started • Changelog • Contributing • License Instalación 📡 Homebrew brew install cariddi Snap sud...

CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

EUVD-2026-97068

pH7Builder pH7 Social Dating CMS before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with privateapikey=dev772277 and the default allowed URL t...

CVE-2026-108905

Versions of pH7Builder (pH7 Social Dating CMS) prior to 18.6.0 are vulnerable to a hard-coded API key flaw in Tool.class.php . Unauthenticated attackers can bypass API access checks by spoofing the Host header (e.g., Host: localhost) while providing the hard-coded key private_api_key=dev772277. T...

CVE-2026-108904

The pH7Builder (pH7 Social Dating CMS) version before 18.5.0 contains an information disclosure vulnerability. The root cause is that the UserController::users() and user() functions return unfiltered database rows to API clients. An attacker possessing a valid private API key can exploit this to...

CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...

CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...

CVE-2026-108719

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...

CVE-2026-108719 LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...

CVE-2026-108719 LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...

CVE-2026-108719

LLMGateway through 1.20.0 is vulnerable to a blind server-side request forgery (SSRF) vulnerability in its video-generation callback_url extension. API key holders can exploit this by supplying loopback, private, or cloud-metadata URLs. The vulnerability exists because the application fails to pe...

EUVD-2026-96993

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...

CVE-2026-108719: Server-Side Request Forgery (SSRF)

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callbackurl extension. Attackers can supply loopback, private, or cloud-metadata URLs that deliverWebhook POSTs to without the...

PT-2026-110114

Name of the Vulnerable Software and Affected Versions Plastic Labs Honcho versions prior to 3.3.1 Description An incorrect authorization issue exists where holders of peer- or session-scoped API keys can access workspace data. This occurs because the get or create workspace function only verifies...

PT-2026-110142

Name of the Vulnerable Software and Affected Versions OpenAgents Workspace backend versions prior to 1.0.18 Description An information disclosure issue exists that allows unauthenticated attackers to list all workspaces. By accessing the 'GET /v1/workspaces' endpoint, attackers can retrieve...